Commit 95b5e9bd authored by Georg Neis's avatar Georg Neis Committed by Commit Bot

[turbofan] Introduce JSDataViewRef class.

... and use it in JSCallReducer.

Bug: v8:7790
Change-Id: If8ed329fef4a4de8938a2d7009cb94c0e85242f0
Reviewed-on: https://chromium-review.googlesource.com/c/1314568Reviewed-by: 's avatarMaya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57214}
parent 92b131b2
......@@ -6107,8 +6107,9 @@ Reduction JSCallReducer::ReducePromiseResolveTrampoline(Node* node) {
DCHECK_NE(0, receiver_maps.size());
// Only reduce when all {receiver_maps} are JSReceiver maps.
for (Handle<Map> receiver_map : receiver_maps) {
if (!receiver_map->IsJSReceiverMap()) return NoChange();
for (Handle<Map> map : receiver_maps) {
MapRef receiver_map(broker(), map);
if (!receiver_map.IsJSReceiverMap()) return NoChange();
}
// Morph the {node} into a JSPromiseResolve operation.
......@@ -6813,18 +6814,18 @@ Reduction JSCallReducer::ReduceDataViewAccess(Node* node, DataViewAccess access,
if (m.HasValue()) {
// We only deal with DataViews here whose [[ByteLength]] is at least
// {element_size}, as for all other DataViews it'll be out-of-bounds.
Handle<JSDataView> dataview = Handle<JSDataView>::cast(m.Value());
if (dataview->byte_length() < element_size) return NoChange();
JSDataViewRef dataview = m.Ref(broker()).AsJSDataView();
if (dataview.byte_length() < element_size) return NoChange();
// Check that the {offset} is within range of the {byte_length}.
Node* byte_length =
jsgraph()->Constant(dataview->byte_length() - (element_size - 1));
jsgraph()->Constant(dataview.byte_length() - (element_size - 1));
offset = effect =
graph()->NewNode(simplified()->CheckBounds(p.feedback()), offset,
byte_length, effect, control);
// Load the [[ByteOffset]] from the {dataview}.
byte_offset = jsgraph()->Constant(dataview->byte_offset());
byte_offset = jsgraph()->Constant(dataview.byte_offset());
} else {
// We only deal with DataViews here that have Smi [[ByteLength]]s.
Node* byte_length = effect =
......@@ -7060,7 +7061,8 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
}
for (auto map : regexp_maps) {
if (map->instance_type() != JS_REGEXP_TYPE) return NoChange();
MapRef receiver_map(broker(), map);
if (receiver_map.instance_type() != JS_REGEXP_TYPE) return NoChange();
}
// Compute property access info for "exec" on {resolution}.
......
......@@ -271,6 +271,19 @@ void JSTypedArrayData::Serialize(JSHeapBroker* broker) {
}
}
class JSDataViewData : public JSObjectData {
public:
JSDataViewData(JSHeapBroker* broker, ObjectData** storage,
Handle<JSDataView> object);
size_t byte_length() const { return byte_length_; }
size_t byte_offset() const { return byte_offset_; }
private:
size_t const byte_length_;
size_t const byte_offset_;
};
class JSBoundFunctionData : public JSObjectData {
public:
JSBoundFunctionData(JSHeapBroker* broker, ObjectData** storage,
......@@ -906,6 +919,12 @@ class FixedArrayData : public FixedArrayBaseData {
ZoneVector<ObjectData*> contents_;
};
JSDataViewData::JSDataViewData(JSHeapBroker* broker, ObjectData** storage,
Handle<JSDataView> object)
: JSObjectData(broker, storage, object),
byte_length_(object->byte_length()),
byte_offset_(object->byte_offset()) {}
JSBoundFunctionData::JSBoundFunctionData(JSHeapBroker* broker,
ObjectData** storage,
Handle<JSBoundFunction> object)
......@@ -2108,6 +2127,9 @@ BIMODAL_ACCESSOR(JSBoundFunction, Object, bound_target_function)
BIMODAL_ACCESSOR(JSBoundFunction, Object, bound_this)
BIMODAL_ACCESSOR(JSBoundFunction, FixedArray, bound_arguments)
BIMODAL_ACCESSOR_C(JSDataView, size_t, byte_length)
BIMODAL_ACCESSOR_C(JSDataView, size_t, byte_offset)
BIMODAL_ACCESSOR_C(JSFunction, bool, has_prototype)
BIMODAL_ACCESSOR_C(JSFunction, bool, has_initial_map)
BIMODAL_ACCESSOR_C(JSFunction, bool, PrototypeRequiresRuntimeLookup)
......
......@@ -21,6 +21,7 @@ class BytecodeArray;
class FixedDoubleArray;
class InternalizedString;
class JSBoundFunction;
class JSDataView;
class JSGlobalProxy;
class JSRegExp;
class JSTypedArray;
......@@ -45,6 +46,7 @@ enum class OddballType : uint8_t {
/* Subtypes of JSObject */ \
V(JSArray) \
V(JSBoundFunction) \
V(JSDataView) \
V(JSFunction) \
V(JSGlobalProxy) \
V(JSRegExp) \
......@@ -198,6 +200,15 @@ class JSObjectRef : public HeapObjectRef {
base::Optional<MapRef> GetObjectCreateMap() const;
};
class JSDataViewRef : public JSObjectRef {
public:
using JSObjectRef::JSObjectRef;
Handle<JSDataView> object() const;
size_t byte_length() const;
size_t byte_offset() const;
};
class JSBoundFunctionRef : public JSObjectRef {
public:
using JSObjectRef::JSObjectRef;
......
......@@ -537,7 +537,8 @@ bool NodeProperties::HasInstanceTypeWitness(JSHeapBroker* broker,
case NodeProperties::kReliableReceiverMaps:
DCHECK_NE(0, receiver_maps.size());
for (size_t i = 0; i < receiver_maps.size(); ++i) {
if (receiver_maps[i]->instance_type() != instance_type) return false;
MapRef map(broker, receiver_maps[i]);
if (map.instance_type() != instance_type) return false;
}
return true;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment